From f8af72bbf14000f43d95a512750fe125aae4ba96 Mon Sep 17 00:00:00 2001
From: Tim Elfrink <Tim.Elfrink@stepstone.de>
Date: Wed, 8 Oct 2025 10:31:35 +0200
Subject: [PATCH 1/2] fix: redact AWS credentials when redact_user_api_key_info
 enabled

Use SensitiveDataMasker in print_deployment() to mask all sensitive
credentials including AWS keys when redact_user_api_key_info is True.

Fixes #14839
---
 ...odel_prices_and_context_window_backup.json |  3 +--
 litellm/router.py                             | 19 ++++++++++---
 .../test_router_helper_utils.py               | 27 +++++++++++++++++++
 3 files changed, 44 insertions(+), 5 deletions(-)

diff --git a/litellm/model_prices_and_context_window_backup.json b/litellm/model_prices_and_context_window_backup.json
index bdfc4fd020b..29a65887747 100644
--- a/litellm/model_prices_and_context_window_backup.json
+++ b/litellm/model_prices_and_context_window_backup.json
@@ -13303,8 +13303,7 @@
         "supported_endpoints": [
             "/v1/images/generations",
             "/v1/images/edits"
-        ],
-        "supports_vision": true
+        ]
     },
     "gpt-realtime": {
         "cache_creation_input_audio_token_cost": 4e-07,
diff --git a/litellm/router.py b/litellm/router.py
index ef7bcba635f..5349a212d66 100644
--- a/litellm/router.py
+++ b/litellm/router.py
@@ -59,6 +59,7 @@ from litellm.litellm_core_utils.coroutine_checker import coroutine_checker
 from litellm.litellm_core_utils.credential_accessor import CredentialAccessor
 from litellm.litellm_core_utils.dd_tracing import tracer
 from litellm.litellm_core_utils.litellm_logging import Logging as LiteLLMLogging
+from litellm.litellm_core_utils.sensitive_data_masker import SensitiveDataMasker
 from litellm.router_strategy.budget_limiter import RouterBudgetLimiting
 from litellm.router_strategy.least_busy import LeastBusyLoggingHandler
 from litellm.router_strategy.lowest_cost import LowestCostLoggingHandler
@@ -142,10 +143,17 @@ from litellm.types.router import (
     RoutingStrategy,
 )
 from litellm.types.services import ServiceTypes
-from litellm.types.utils import GenericBudgetConfigType, LiteLLMBatch
+from litellm.types.utils import (
+    GenericBudgetConfigType,
+    LiteLLMBatch,
+)
 from litellm.types.utils import ModelInfo
 from litellm.types.utils import ModelInfo as ModelMapInfo
-from litellm.types.utils import ModelResponseStream, StandardLoggingPayload, Usage
+from litellm.types.utils import (
+    ModelResponseStream,
+    StandardLoggingPayload,
+    Usage,
+)
 from litellm.utils import (
     CustomStreamWrapper,
     EmbeddingResponse,
@@ -909,8 +917,13 @@ class Router:
         try:
             _deployment_copy = copy.deepcopy(deployment)
             litellm_params: dict = _deployment_copy["litellm_params"]
-            if "api_key" in litellm_params:
+
+            if litellm.redact_user_api_key_info:
+                masker = SensitiveDataMasker(visible_prefix=2, visible_suffix=0)
+                _deployment_copy["litellm_params"] = masker.mask_dict(litellm_params)
+            elif "api_key" in litellm_params:
                 litellm_params["api_key"] = litellm_params["api_key"][:2] + "*" * 10
+
             return _deployment_copy
         except Exception as e:
             verbose_router_logger.debug(
diff --git a/tests/router_unit_tests/test_router_helper_utils.py b/tests/router_unit_tests/test_router_helper_utils.py
index 094df944bcc..a31c4d8210f 100644
--- a/tests/router_unit_tests/test_router_helper_utils.py
+++ b/tests/router_unit_tests/test_router_helper_utils.py
@@ -94,6 +94,33 @@ def test_print_deployment(model_list):
     assert 10 * "*" in printed_deployment["litellm_params"]["api_key"]
 
 
+def test_print_deployment_with_redact_enabled(model_list):
+    """Test if sensitive credentials are masked when redact_user_api_key_info is enabled"""
+    import litellm
+
+    router = Router(model_list=model_list)
+    deployment = {
+        "model_name": "bedrock-claude",
+        "litellm_params": {
+            "model": "bedrock/anthropic.claude-v2",
+            "aws_access_key_id": "AKIAIOSFODNN7EXAMPLE",
+            "aws_secret_access_key": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
+            "aws_region_name": "us-west-2",
+        },
+    }
+
+    original_setting = litellm.redact_user_api_key_info
+    try:
+        litellm.redact_user_api_key_info = True
+        printed_deployment = router.print_deployment(deployment)
+
+        assert "*" in printed_deployment["litellm_params"]["aws_access_key_id"]
+        assert "*" in printed_deployment["litellm_params"]["aws_secret_access_key"]
+        assert "us-west-2" == printed_deployment["litellm_params"]["aws_region_name"]
+    finally:
+        litellm.redact_user_api_key_info = original_setting
+
+
 def test_completion(model_list):
     """Test if the completion function is working correctly"""
     router = Router(model_list=model_list)

From 56b2c914edbeb389f72d9a3cea370c64b2f118cb Mon Sep 17 00:00:00 2001
From: Tim Elfrink <Tim.Elfrink@stepstone.de>
Date: Thu, 9 Oct 2025 08:13:16 +0200
Subject: [PATCH 2/2] Apply isort formatting to router.py imports

---
 litellm/router.py | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/litellm/router.py b/litellm/router.py
index f56caafa06c..5972b06f01a 100644
--- a/litellm/router.py
+++ b/litellm/router.py
@@ -143,12 +143,17 @@ from litellm.types.router import (
 )
 from litellm.types.services import ServiceTypes
 from litellm.types.utils import (
+    CustomPricingLiteLLMParams,
     GenericBudgetConfigType,
     LiteLLMBatch,
 )
 from litellm.types.utils import ModelInfo
 from litellm.types.utils import ModelInfo as ModelMapInfo
-from litellm.types.utils import ModelResponseStream, StandardLoggingPayload, Usage, CustomPricingLiteLLMParams
+from litellm.types.utils import (
+    ModelResponseStream,
+    StandardLoggingPayload,
+    Usage,
+)
 from litellm.utils import (
     CustomStreamWrapper,
     EmbeddingResponse,